spring-projects / spring-projects/spring-security
CSRF token request is same or different for every requests
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
hi all,
I recall last time, when i use spring security, after login successfully, for each request sent to server, the latter will response with a webpage embedded with the same csrf token. This is understandable, since OWSAP did mention that the csrf token values NO NEED change for every request, unless of course after we logout and relogin again, the CSRF token should change to a different one.
but today using spring security v7 and spring boot 4.1, i notice now every requests returns different csrf tokens.
I have no issue with the change, but just want to get a confirmed my observation is correct
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The report concerns CSRF token behavior in Spring Security v7 with Spring Boot 4.1; start by reproducing requests after login and comparing token values across responses. Check the Spring Security CSRF documentation and relevant tests for the expected token lifecycle. Done means confirming whether per-request rotation is intended and documenting the result.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring-boot
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100